Awesome-Mirrors/awesome-malware-analysis
1
0
Fork 0
mirror of https://github.com/rshipp/awesome-malware-analysis.git synced 2024-06-29 04:52:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update outdated links

Browse Source
This commit is contained in:
rshipp 2017-09-24 19:14:52 -05:00
parent 62d8100381
commit fc3125268b
No known key found for this signature in database
GPG Key ID: 1F4037ED24A4D1F0
2 changed files with 22 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
README.md
View File

@ -77,7 +77,7 @@ A curated list of awesome malware analysis tools and resources. Inspired by
malware samples and analyses. malware samples and analyses.
* [Exploit Database](https://www.exploit-db.com/) - Exploit and shellcode * [Exploit Database](https://www.exploit-db.com/) - Exploit and shellcode
samples. samples.
* [Malshare](http://malshare.com) - Large repository of malware actively * [Malshare](https://malshare.com) - Large repository of malware actively
scrapped from malicious sites. scrapped from malicious sites.
samples directly from a number of online sources. samples directly from a number of online sources.
* [MalwareDB](http://malwaredb.malekal.com/) - Malware samples repository. * [MalwareDB](http://malwaredb.malekal.com/) - Malware samples repository.
@ -124,9 +124,9 @@ A curated list of awesome malware analysis tools and resources. Inspired by
from various lists. Curated by the [CSIRT Gadgets Foundation](http://csirtgadgets.org/collective-intelligence-framework). from various lists. Curated by the [CSIRT Gadgets Foundation](http://csirtgadgets.org/collective-intelligence-framework).
* [MISP](https://github.com/MISP/MISP) - Malware Information Sharing * [MISP](https://github.com/MISP/MISP) - Malware Information Sharing
Platform curated by [The MISP Project](http://www.misp-project.org/). Platform curated by [The MISP Project](http://www.misp-project.org/).
* [PassiveTotal](https://www.passivetotal.org/) - Research, connect, tag and
share IPs and domains.
* [PyIOCe](https://github.com/pidydx/PyIOCe) - A Python OpenIOC editor. * [PyIOCe](https://github.com/pidydx/PyIOCe) - A Python OpenIOC editor.
* [RiskIQ](https://community.riskiq.com/) - Research, connect, tag and
share IPs and domains. (Was PassiveTotal.)
* [threataggregator](https://github.com/jpsenior/threataggregator) - * [threataggregator](https://github.com/jpsenior/threataggregator) -
Aggregates security threats from a number of sources, including some of Aggregates security threats from a number of sources, including some of
those listed below in [other resources](#other-resources). those listed below in [other resources](#other-resources).
@ -200,7 +200,7 @@ YARA rules.
* [ClamAV](http://www.clamav.net/) - Open source antivirus engine. * [ClamAV](http://www.clamav.net/) - Open source antivirus engine.
* [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy) - A program for * [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy) - A program for
determining types of files. determining types of files.
* [ExifTool](http://www.sno.phy.queensu.ca/~phil/exiftool/) - Read, write and * [ExifTool](https://sno.phy.queensu.ca/~phil/exiftool/) - Read, write and
edit file metadata. edit file metadata.
* [File Scanning Framework](https://github.com/EmersonElectricCo/fsf) - * [File Scanning Framework](https://github.com/EmersonElectricCo/fsf) -
Modular, recursive file scanning solution. Modular, recursive file scanning solution.
@ -220,7 +220,7 @@ YARA rules.
* [PEV](http://pev.sourceforge.net/) - A multiplatform toolkit to work with PE * [PEV](http://pev.sourceforge.net/) - A multiplatform toolkit to work with PE
files, providing feature-rich tools for proper analysis of suspicious binaries. files, providing feature-rich tools for proper analysis of suspicious binaries.
* [Rootkit Hunter](http://rkhunter.sourceforge.net/) - Detect Linux rootkits. * [Rootkit Hunter](http://rkhunter.sourceforge.net/) - Detect Linux rootkits.
* [ssdeep](http://ssdeep.sourceforge.net/) - Compute fuzzy hashes. * [ssdeep](https://ssdeep-project.github.io/ssdeep/) - Compute fuzzy hashes.
* [totalhash.py](https://gist.github.com/gleblanc1783/3c8e6b379fa9d646d401b96ab5c7877f) - Python script * [totalhash.py](https://gist.github.com/gleblanc1783/3c8e6b379fa9d646d401b96ab5c7877f) - Python script
for easy searching of the [TotalHash.cymru.com](https://totalhash.cymru.com/) database. for easy searching of the [TotalHash.cymru.com](https://totalhash.cymru.com/) database.
* [TrID](http://mark0.net/soft-trid-e.html) - File identifier. * [TrID](http://mark0.net/soft-trid-e.html) - File identifier.
@ -233,7 +233,6 @@ YARA rules.
## Online Scanners and Sandboxes ## Online Scanners and Sandboxes
*Web-based multi-AV scanners, and malware sandboxes for automated analysis.* *Web-based multi-AV scanners, and malware sandboxes for automated analysis.*
* [APK Analyzer](https://www.apk-analyzer.net/) - Free dynamic analysis of APKs.
* [AndroTotal](https://andrototal.org/) - Free online analysis of APKs * [AndroTotal](https://andrototal.org/) - Free online analysis of APKs
against multiple mobile antivirus apps. against multiple mobile antivirus apps.
* [AVCaesar](https://avcaesar.malware.lu/) - Malware.lu online scanner and * [AVCaesar](https://avcaesar.malware.lu/) - Malware.lu online scanner and
@ -250,10 +249,8 @@ YARA rules.
machine-learning classification. machine-learning classification.
* [detux](https://github.com/detuxsandbox/detux/) - A sandbox developed to do traffic analysis * [detux](https://github.com/detuxsandbox/detux/) - A sandbox developed to do traffic analysis
of Linux malwares and capturing IOCs. of Linux malwares and capturing IOCs.
* [Document Analyzer](https://www.document-analyzer.net/) - Free dynamic analysis of DOC and PDF files.
* [DRAKVUF](https://github.com/tklengyel/drakvuf) - Dynamic malware analysis * [DRAKVUF](https://github.com/tklengyel/drakvuf) - Dynamic malware analysis
system. system.
* [File Analyzer](https://www.file-analyzer.net/) - Free dynamic analysis of PE files.
* [firmware.re](http://firmware.re/) - Unpacks, scans and analyzes almost any firmware package. * [firmware.re](http://firmware.re/) - Unpacks, scans and analyzes almost any firmware package.
* [HaboMalHunter](https://github.com/Tencent/HaboMalHunter) - An Automated Malware Analysis Tool for Linux ELF Files. * [HaboMalHunter](https://github.com/Tencent/HaboMalHunter) - An Automated Malware Analysis Tool for Linux ELF Files.
* [Hybrid Analysis](https://www.hybrid-analysis.com/) - Online malware * [Hybrid Analysis](https://www.hybrid-analysis.com/) - Online malware
@ -287,7 +284,6 @@ YARA rules.
Android application analysis system. Android application analysis system.
* [SEE](https://github.com/F-Secure/see) - Sandboxed Execution Environment (SEE) * [SEE](https://github.com/F-Secure/see) - Sandboxed Execution Environment (SEE)
is a framework for building test automation in secured Environments. is a framework for building test automation in secured Environments.
* [URL Analyzer](https://www.url-analyzer.net/) - Free dynamic analysis of URL files.
* [VirusTotal](https://www.virustotal.com/) - Free online analysis of malware * [VirusTotal](https://www.virustotal.com/) - Free online analysis of malware
samples and URLs samples and URLs
* [Visualize_Logs](https://github.com/keithjjones/visualize_logs) - Open source * [Visualize_Logs](https://github.com/keithjjones/visualize_logs) - Open source
@ -320,13 +316,13 @@ YARA rules.
* [NormShield Services](https://services.normshield.com/) - Free API Services * [NormShield Services](https://services.normshield.com/) - Free API Services
for detecting possible phishing domains, blacklisted ip addresses and breached for detecting possible phishing domains, blacklisted ip addresses and breached
accounts. accounts.
* [SenderBase](http://www.senderbase.org/) - Search for IP, domain or network
owner.
* [SpamCop](https://www.spamcop.net/bl.shtml) - IP based spam block list. * [SpamCop](https://www.spamcop.net/bl.shtml) - IP based spam block list.
* [SpamHaus](https://www.spamhaus.org/lookup/) - Block list based on * [SpamHaus](https://www.spamhaus.org/lookup/) - Block list based on
domains and IPs. domains and IPs.
* [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - Free Website Malware * [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - Free Website Malware
and Security Scanner. and Security Scanner.
* [Talos Intelligence](https://talosintelligence.com/) - Search for IP, domain or network
owner. (Previously SenderBase.)
* [TekDefense Automater](http://www.tekdefense.com/automater/) - OSINT tool * [TekDefense Automater](http://www.tekdefense.com/automater/) - OSINT tool
for gathering information about URLs, IPs, or hashes. for gathering information about URLs, IPs, or hashes.
* [URLQuery](http://urlquery.net/) - Free URL Scanner. * [URLQuery](http://urlquery.net/) - Free URL Scanner.
@ -334,14 +330,14 @@ YARA rules.
search. search.
* [Zeltser's List](https://zeltser.com/lookup-malicious-websites/) - Free * [Zeltser's List](https://zeltser.com/lookup-malicious-websites/) - Free
online tools for researching malicious websites, compiled by Lenny Zeltser. online tools for researching malicious websites, compiled by Lenny Zeltser.
* [ZScalar Zulu](http://zulu.zscaler.com/#) - Zulu URL Risk Analyzer. * [ZScalar Zulu](https://zulu.zscaler.com/#) - Zulu URL Risk Analyzer.
## Browser Malware ## Browser Malware
*Analyze malicious URLs. See also the [domain analysis](#domain-analysis) and *Analyze malicious URLs. See also the [domain analysis](#domain-analysis) and
[documents and shellcode](#documents-and-shellcode) sections.* [documents and shellcode](#documents-and-shellcode) sections.*
* [Firebug](http://getfirebug.com/) - Firefox extension for web development. * [Firebug](https://getfirebug.com/) - Firefox extension for web development.
* [Java Decompiler](http://jd.benow.ca/) - Decompile and inspect Java apps. * [Java Decompiler](http://jd.benow.ca/) - Decompile and inspect Java apps.
* [Java IDX Parser](https://github.com/Rurik/Java_IDX_Parser/) - Parses Java * [Java IDX Parser](https://github.com/Rurik/Java_IDX_Parser/) - Parses Java
IDX cache files. IDX cache files.
@ -506,12 +502,12 @@ the [browser malware](#browser-malware) section.*
* [PPEE (puppy)](https://www.mzrst.com/) - A Professional PE file Explorer for * [PPEE (puppy)](https://www.mzrst.com/) - A Professional PE file Explorer for
reversers, malware researchers and those who want to statically inspect PE reversers, malware researchers and those who want to statically inspect PE
files in more detail. files in more detail.
* [Process Explorer](https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx) - * [Process Explorer](https://docs.microsoft.com/sysinternals/downloads/process-explorer) -
Advanced task manager for Windows. Advanced task manager for Windows.
* [Process Hacker](http://processhacker.sourceforge.net/) - Tool that monitors system resources. * [Process Hacker](http://processhacker.sourceforge.net/) - Tool that monitors system resources.
* [Process Monitor](https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) - * [Process Monitor](https://docs.microsoft.com/sysinternals/downloads/procmon) -
Advanced monitoring tool for Windows programs. Advanced monitoring tool for Windows programs.
* [PSTools](https://technet.microsoft.com/en-us/sysinternals/pstools.aspx) - Windows * [PSTools](https://docs.microsoft.com/sysinternals/downloads/pstools) - Windows
command-line tools that help manage and investigate live systems. command-line tools that help manage and investigate live systems.
* [Pyew](https://github.com/joxeankoret/pyew) - Python tool for malware * [Pyew](https://github.com/joxeankoret/pyew) - Python tool for malware
analysis. analysis.

24
恶意软件分析大合集.md
View File

@ -65,7 +65,7 @@
* [Clean MX](http://support.clean-mx.de/clean-mx/viruses.php) - 恶意软件和恶意域名的实时数据库 * [Clean MX](http://support.clean-mx.de/clean-mx/viruses.php) - 恶意软件和恶意域名的实时数据库
* [Contagio](http://contagiodump.blogspot.com/) - 近期的恶意软件样本和分析的收集 * [Contagio](http://contagiodump.blogspot.com/) - 近期的恶意软件样本和分析的收集
* [Exploit Database](https://www.exploit-db.com/) - Exploit 和 shellcode 样本 * [Exploit Database](https://www.exploit-db.com/) - Exploit 和 shellcode 样本
* [Malshare](http://malshare.com) - 在恶意网站上得到的大量恶意样本库 * [Malshare](https://malshare.com) - 在恶意网站上得到的大量恶意样本库
* [MalwareDB](http://malwaredb.malekal.com/) - 恶意软件样本库 * [MalwareDB](http://malwaredb.malekal.com/) - 恶意软件样本库
* [Open Malware Project](http://openmalware.org/) - 样本信息和下载 * [Open Malware Project](http://openmalware.org/) - 样本信息和下载
* [Ragpicker](https://github.com/robbyFux/Ragpicker) - 基于 malware crawler 的一个插件 * [Ragpicker](https://github.com/robbyFux/Ragpicker) - 基于 malware crawler 的一个插件
@ -93,8 +93,8 @@
* [ioc_writer](https://github.com/mandiant/ioc_writer) - 开发的用于 OpenIOC 对象的 Python 库 * [ioc_writer](https://github.com/mandiant/ioc_writer) - 开发的用于 OpenIOC 对象的 Python 库
* [Massive Octo Spice](https://github.com/csirtgadgets/massive-octo-spice) - 由 [CSIRT Gadgets Foundation](http://csirtgadgets.org/collective-intelligence-framework)发起，之前叫做 CIF (Collective Intelligence Framework)，从各种信息源聚合 IOC 信息 * [Massive Octo Spice](https://github.com/csirtgadgets/massive-octo-spice) - 由 [CSIRT Gadgets Foundation](http://csirtgadgets.org/collective-intelligence-framework)发起，之前叫做 CIF (Collective Intelligence Framework)，从各种信息源聚合 IOC 信息
* [MISP](https://github.com/MISP/MISP) - 由 [The MISP Project](http://www.misp-project.org/) 发起的恶意软件信息共享平台 * [MISP](https://github.com/MISP/MISP) - 由 [The MISP Project](http://www.misp-project.org/) 发起的恶意软件信息共享平台
* [PassiveTotal](https://www.passivetotal.org/) - 研究、链接、标注和分享 IP 与 域名
* [PyIOCe](https://github.com/pidydx/PyIOCe) - 一个 Python OpenIOC 编辑器 * [PyIOCe](https://github.com/pidydx/PyIOCe) - 一个 Python OpenIOC 编辑器
* [RiskIQ](https://community.riskiq.com/) - 研究、链接、标注和分享 IP 与 域名
* [threataggregator](https://github.com/jpsenior/threataggregator) - 聚合来自多个信息源的安全威胁，包括 [other resources](#other-resources) 列表中的一些 * [threataggregator](https://github.com/jpsenior/threataggregator) - 聚合来自多个信息源的安全威胁，包括 [other resources](#other-resources) 列表中的一些
* [ThreatCrowd](https://www.threatcrowd.org/) - 带有图形可视化的威胁搜索引擎 * [ThreatCrowd](https://www.threatcrowd.org/) - 带有图形可视化的威胁搜索引擎
* [TIQ-test](https://github.com/mlsecproject/tiq-test) - 威胁情报源的数据可视化和统计分析 * [TIQ-test](https://github.com/mlsecproject/tiq-test) - 威胁情报源的数据可视化和统计分析
@ -138,7 +138,7 @@
* [chkrootkit](http://www.chkrootkit.org/) - 本地 Linux rootkit 检测 * [chkrootkit](http://www.chkrootkit.org/) - 本地 Linux rootkit 检测
* [ClamAV](http://www.clamav.net/) - 开源反病毒引擎 * [ClamAV](http://www.clamav.net/) - 开源反病毒引擎
* [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy) - 用于确定文件类型的程序 * [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy) - 用于确定文件类型的程序
* [ExifTool](http://www.sno.phy.queensu.ca/~phil/exiftool/) - 读、写、编辑文件的元数据 * [ExifTool](https://sno.phy.queensu.ca/~phil/exiftool/) - 读、写、编辑文件的元数据
* [File Scanning Framework](http://www.sno.phy.queensu.ca/%7Ephil/exiftool/) - 模块化的递归文件扫描解决方案 * [File Scanning Framework](http://www.sno.phy.queensu.ca/%7Ephil/exiftool/) - 模块化的递归文件扫描解决方案
* [hashdeep](https://github.com/jessek/hashdeep) - 用各种算法计算哈希值 * [hashdeep](https://github.com/jessek/hashdeep) - 用各种算法计算哈希值
* [Loki](https://github.com/Neo23x0/Loki) - 基于主机的 IOC 扫描器 * [Loki](https://github.com/Neo23x0/Loki) - 基于主机的 IOC 扫描器
@ -149,7 +149,7 @@
* [packerid](http://handlers.sans.org/jclausing/packerid.py) - 跨平台的 PEiD 的替代品 * [packerid](http://handlers.sans.org/jclausing/packerid.py) - 跨平台的 PEiD 的替代品
* [PEV](http://pev.sourceforge.net/) - 为正确分析可疑的二进制文件提供功能丰富工具的 PE 文件多平台分析工具集 * [PEV](http://pev.sourceforge.net/) - 为正确分析可疑的二进制文件提供功能丰富工具的 PE 文件多平台分析工具集
* [Rootkit Hunter](http://rkhunter.sourceforge.net/) - 检测 Linux 的 rootkits * [Rootkit Hunter](http://rkhunter.sourceforge.net/) - 检测 Linux 的 rootkits
* [ssdeep](http://ssdeep.sourceforge.net/) - 计算模糊哈希值 * [ssdeep](https://ssdeep-project.github.io/ssdeep/) - 计算模糊哈希值
* [totalhash.py](https://gist.github.com/malc0de/10270150) - 一个简单搜索[TotalHash.com](http://totalhash.com/) 数据库的 Python 脚本 * [totalhash.py](https://gist.github.com/malc0de/10270150) - 一个简单搜索[TotalHash.com](http://totalhash.com/) 数据库的 Python 脚本
* [TrID](http://mark0.net/soft-trid-e.html) - 文件识别 * [TrID](http://mark0.net/soft-trid-e.html) - 文件识别
* [YARA](https://plusvic.github.io/yara/) - 分析师利用的模式识别工具 * [YARA](https://plusvic.github.io/yara/) - 分析师利用的模式识别工具
@ -159,7 +159,6 @@
*基于 Web 的多反病毒引擎扫描器和恶意软件自动分析的沙盒* *基于 Web 的多反病毒引擎扫描器和恶意软件自动分析的沙盒*
* [APK Analyzer](https://www.apk-analyzer.net/) - APK 免费动态分析
* [AndroTotal](https://andrototal.org/) - 利用多个移动反病毒软件进行免费在线分析 App * [AndroTotal](https://andrototal.org/) - 利用多个移动反病毒软件进行免费在线分析 App
* [AVCaesar](https://avcaesar.malware.lu/) - Malware.lu 在线扫描器和恶意软件集合 * [AVCaesar](https://avcaesar.malware.lu/) - Malware.lu 在线扫描器和恶意软件集合
* [Cryptam](http://www.cryptam.com/) - 分析可疑的 Office 文档 * [Cryptam](http://www.cryptam.com/) - 分析可疑的 Office 文档
@ -168,9 +167,7 @@
* [cuckoo-modified-api](https://github.com/brad-accuvant/cuckoo-modified) - 用于控制 cuckoo-modified 沙盒的 Python API * [cuckoo-modified-api](https://github.com/brad-accuvant/cuckoo-modified) - 用于控制 cuckoo-modified 沙盒的 Python API
* [DeepViz](https://www.deepviz.com/) - 通过机器学习分类来分析的多格式文件分析器 * [DeepViz](https://www.deepviz.com/) - 通过机器学习分类来分析的多格式文件分析器
* [detux](https://github.com/detuxsandbox/detux/) - 一个用于对 Linux 恶意软件流量分析与 IOC 信息捕获的沙盒 * [detux](https://github.com/detuxsandbox/detux/) - 一个用于对 Linux 恶意软件流量分析与 IOC 信息捕获的沙盒
* [Document Analyzer](https://www.document-analyzer.net/) - DOC 和 PDF 文件的免费动态分析
* [DRAKVUF](https://github.com/tklengyel/drakvuf) - 动态恶意软件分析系统 * [DRAKVUF](https://github.com/tklengyel/drakvuf) - 动态恶意软件分析系统
* [File Analyzer](https://www.file-analyzer.net/) - 免费 PE 文件动态分析
* [firmware.re](http://firmware.re/) - 解包、扫描、分析绝大多数固件包 * [firmware.re](http://firmware.re/) - 解包、扫描、分析绝大多数固件包
* [HaboMalHunter](https://github.com/Tencent/HaboMalHunter) - Linux平台上的自动化恶意代码分析工具. * [HaboMalHunter](https://github.com/Tencent/HaboMalHunter) - Linux平台上的自动化恶意代码分析工具.
* [Hybrid Analysis](https://www.hybrid-analysis.com/) - 由 VxSandbox 支持的在线恶意软件分析工具 * [Hybrid Analysis](https://www.hybrid-analysis.com/) - 由 VxSandbox 支持的在线恶意软件分析工具
@ -190,7 +187,6 @@
* [Recomposer](https://github.com/secretsquirrel/recomposer) - 安全上传二进制程序到沙盒网站的辅助脚本 * [Recomposer](https://github.com/secretsquirrel/recomposer) - 安全上传二进制程序到沙盒网站的辅助脚本
* [Sand droid](http://sanddroid.xjtu.edu.cn/) - 自动化、完整的 Android 应用程序分析系统 * [Sand droid](http://sanddroid.xjtu.edu.cn/) - 自动化、完整的 Android 应用程序分析系统
* [SEE](https://github.com/F-Secure/see) - 在安全环境中构建测试自动化的框架 * [SEE](https://github.com/F-Secure/see) - 在安全环境中构建测试自动化的框架
* [URL Analyzer](https://www.url-analyzer.net/) - 对 URL 文件的动态分析
* [VirusTotal](https://www.virustotal.com/) - 免费的在线恶意软件样本和 URL 分析 * [VirusTotal](https://www.virustotal.com/) - 免费的在线恶意软件样本和 URL 分析
* [Visualize_Logs](https://github.com/keithjjones/visualize_logs) - 用于日志的开源可视化库和命令行工具（Cuckoo、Procmon 等） * [Visualize_Logs](https://github.com/keithjjones/visualize_logs) - 用于日志的开源可视化库和命令行工具（Cuckoo、Procmon 等）
* [Zeltser's List](https://zeltser.com/automated-malware-analysis/) - Lenny Zeltser 创建的免费自动沙盒服务 * [Zeltser's List](https://zeltser.com/automated-malware-analysis/) - Lenny Zeltser 创建的免费自动沙盒服务
@ -207,21 +203,21 @@
* [mailchecker](https://github.com/FGRibreau/mailchecker) - 跨语言临时邮件检测库 * [mailchecker](https://github.com/FGRibreau/mailchecker) - 跨语言临时邮件检测库
* [MaltegoVT](https://github.com/michael-yip/MaltegoVT) - 让 Maltego 使用 VirusTotal API，允许搜索域名、IP 地址、文件哈希、报告 * [MaltegoVT](https://github.com/michael-yip/MaltegoVT) - 让 Maltego 使用 VirusTotal API，允许搜索域名、IP 地址、文件哈希、报告
* [Multi rbl](http://multirbl.valli.org/) - 多个 DNS 黑名单，反向查找超过 300 个 RBL。 * [Multi rbl](http://multirbl.valli.org/) - 多个 DNS 黑名单，反向查找超过 300 个 RBL。
* [SenderBase](http://www.senderbase.org/) - 搜索 IP、域名或网络的所有者
* [SpamCop](https://www.spamcop.net/bl.shtml) - 垃圾邮件 IP 黑名单IP * [SpamCop](https://www.spamcop.net/bl.shtml) - 垃圾邮件 IP 黑名单IP
* [SpamHaus](http://www.spamhaus.org/lookup/) - 基于域名和 IP 的黑名单 * [SpamHaus](http://www.spamhaus.org/lookup/) - 基于域名和 IP 的黑名单
* [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - 免费的网站恶意软件与安全扫描器 * [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - 免费的网站恶意软件与安全扫描器
* [Talos Intelligence](https://talosintelligence.com/) - 搜索 IP、域名或网络的所有者
* [TekDefense Automator](http://www.tekdefense.com/automater/) - 收集关于 URL、IP 和哈希值的 OSINT 工具 * [TekDefense Automator](http://www.tekdefense.com/automater/) - 收集关于 URL、IP 和哈希值的 OSINT 工具
* [URLQuery](http://urlquery.net/) - 免费的 URL 扫描器 * [URLQuery](http://urlquery.net/) - 免费的 URL 扫描器
* [Whois](http://whois.domaintools.com/) - DomainTools 家免费的 whois 搜索 * [Whois](http://whois.domaintools.com/) - DomainTools 家免费的 whois 搜索
* [Zeltser's List](https://zeltser.com/lookup-malicious-websites/) - 由 Lenny Zeltser 整理的免费在线恶意软件工具集 * [Zeltser's List](https://zeltser.com/lookup-malicious-websites/) - 由 Lenny Zeltser 整理的免费在线恶意软件工具集
* [ZScalar Zulu](http://zulu.zscaler.com/#) - Zulu URL 风险分析 * [ZScalar Zulu](https://zulu.zscaler.com/#) - Zulu URL 风险分析
## 浏览器恶意软件 ## 浏览器恶意软件
*分析恶意 URL，也可以参考 [domain analysis](#domain-analysis) 和 [documents and shellcode](#documents-and-shellcode) 部分* *分析恶意 URL，也可以参考 [domain analysis](#domain-analysis) 和 [documents and shellcode](#documents-and-shellcode) 部分*
* [Firebug](http://getfirebug.com/) - Firefox Web 开发扩展 * [Firebug](https://getfirebug.com/) - Firefox Web 开发扩展
* [Java Decompiler](http://jd.benow.ca/) - 反编译并检查 Java 的应用 * [Java Decompiler](http://jd.benow.ca/) - 反编译并检查 Java 的应用
* [Java IDX Parser](https://github.com/Rurik/Java_IDX_Parser/) - 解析 Java IDX 缓存文件 * [Java IDX Parser](https://github.com/Rurik/Java_IDX_Parser/) - 解析 Java IDX 缓存文件
* [JSDetox](http://www.relentless-coding.com/projects/jsdetox/) - JavaScript 恶意软件分析工具 * [JSDetox](http://www.relentless-coding.com/projects/jsdetox/) - JavaScript 恶意软件分析工具
@ -309,9 +305,9 @@
* [pestudio](https://winitor.com/) - Windows 可执行程序的静态分析 * [pestudio](https://winitor.com/) - Windows 可执行程序的静态分析
* [plasma](https://github.com/joelpx/plasma) - 面向 x86/ARM/MIPS 的交互式反汇编器 * [plasma](https://github.com/joelpx/plasma) - 面向 x86/ARM/MIPS 的交互式反汇编器
* [PPEE (puppy)](https://www.mzrst.com/) - 专业的 PE 文件资源管理器 * [PPEE (puppy)](https://www.mzrst.com/) - 专业的 PE 文件资源管理器
* [Process Explorer ](https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx) - 高级 Windows 任务管理器 * [Process Explorer](https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx) - 高级 Windows 任务管理器
* [Process Monitor](https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) - Windows 下高级程序监控工具 * [Process Monitor](https://docs.microsoft.com/sysinternals/downloads/procmon) - Windows 下高级程序监控工具
* [PSTools](https://technet.microsoft.com/en-us/sysinternals/pstools.aspx) - 可以帮助管理员实时管理系统的 Windows 命令行工具 * [PSTools](https://docs.microsoft.com/sysinternals/downloads/pstools) - 可以帮助管理员实时管理系统的 Windows 命令行工具
* [Pyew](https://github.com/joxeankoret/pyew) - 恶意软件分析的 Python 工具 * [Pyew](https://github.com/joxeankoret/pyew) - 恶意软件分析的 Python 工具
* [Radare2](http://www.radare.org/r/) - 带有调试器支持的逆向工程框架 * [Radare2](http://www.radare.org/r/) - 带有调试器支持的逆向工程框架
* [RetDec](https://retdec.com/) - 可重定向的机器码反编译器，同时有在线反编译服务和 API * [RetDec](https://retdec.com/) - 可重定向的机器码反编译器，同时有在线反编译服务和 API